Two IPSec

[AbdY]

Hello Guys 

I have a design that I requires a two VPN connections from my Office to other offices. Some of the remote offices has same IP subnet like Office 1 has subnet 192.168.10.0 and Office 2 has the same subnet

I want to setup two VPN tunnels to each office. one tunnel will be active and the second one will be standby

Also I want to use PBR with these two IPSec but I am not able to figure out how the routing will be 

if I have each office in different subnet i can create two static route (one for each IPSec) and use link monitor to remove the static route from routting table in case first IPSec failed

is there any option PBR in fortigate ?

thanks in advance 

[Toshi_Esumi]

I suggest you follow this thread we had entire today. You seem to have gotten the exact same problem.

https://forum.fortinet.com/tm.aspx?m=162619&tree=true

[AbdY]

Hello Toshi, 

Thanks for your feed back

it is almost the same scenario however I have two IPSec tunnels from to each site 

the overlap is happening on the remote site and  I am wondering if there is a way to use PBR in my case 

if the first IPSec tunnel for Office one went down that PBR will not be in use and we will use  the second PBR for the second IPSec tunnel (To office one)

Thanks again

[Toshi_Esumi]

Generally policy route can't be mixed with fail-over because policy won't disappear when interface goes down. However, you don't need policy route as long as you use link-monitor over the primary path and remove static routes bound to the vpn interface when link-monitor goes down. There have been many discussion in the forum about link-monitor you can find or search in on-line help or KB.

[ericli_FTNT]

You can configured two phase-1 interfaces as SD-WAN.

[Toshi_Esumi]

I have a question with the SD-WAN option. How do you specify one side as primary and the other side is secondary, or even better, split them granularly like bsed on destination ip ranges or sub-subnets? If you could post links for any documentation for 5.6 or 6.0 that would be supper!

Thanks,

Toshi